Page History

...

In general, for a particular escape character of the form \X, the equivalent Java representation is

\\X

Noncompliant Code Example (String Literal)

This noncompliant code example defines a method splitWords() that finds matches between the string literal {{WORDS}} and (WORDS) and the input sequence. It is expected that WORDS would hold the escape sequence for matching a word boundary. However, the Java compiler treats the "\b" literal as a Java escape sequence, and the string WORDS silently compiles to a backspace character.

public class BadSplitterSplitter {
  private final String WORDS = "\b"; // Fails interpreted as backspace, fails to split on word boundaries

  public String[] splitWords(String input){
    Pattern pattern = Pattern.compile(WORDS);
    String[] input_array = pattern.split(input);
    return input_array;
  }
}

Compliant Solution (String Literal)

This compliant solution shows the correctly escaped value of the string literal WORDS that results in a regular expression designed to split on word boundaries.

public class GoodSplitterSplitter {
  private final String WORDS = "\\b"; // Allows splitting interpreted as two chars, '\' and \b'. Correctly splits on word boundaries

  public String[] split(String input){
    Pattern pattern = Pattern.compile(WORDS);
    String[] input_array = pattern.split(input);
    return input_array;
  }
}

Noncompliant Code Example (String Property)

This noncompliant code example uses the same method splitWords(). This time the WORDS string is loaded from an external properties file.

public class Splitter {
  private final String WORDS;
 
  public Splitter() throws IOException {
    Properties properties = new Properties();
    properties.load(new FileInputStream("splitter.properties"));
    WORDS = properties.getProperty("WORDS");
  }

  public String[] split(String input){
    Pattern pattern = Pattern.compile(WORDS);
    String[] input_array = pattern.split(input);
    return input_array;
  }
}

In the properties file, the WORD property is once again incorrectly specified as \b. This is read by the Properties.load() method as a single character b, which causes the split() method to split strings along the letter b.

WORDS: \b

Compliant Solution (String Property)

This compliant solution shows the correctly escaped value of the WORDS property.

WORDS: \\b

Applicability

Incorrect use of escape characters in string literals inputs can result in misinterpretation and potential corruption of data.

...